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Abstract. In the original BB84 protocol by Bennett and Brassard, an eavesdropper 
is detected because his attempts to intercept information result in a quantum bit error 
rate (QBER) of at least 25 %. Here we design an alternative quantum key distribution 
protocol, where Alice and Bob use two mutually unbiased bases with one of them 
encoding a "0" and the other one encoding a "1." The security of the scheme is due to 
a minimum index transmission error rate (ITER) introduced by an eavesdropper which 
increases significantly for higher-dimensional photon states. This allows for more noise 
in the transmission line, thereby increasing the possible distance between Alice and 
Bob without the need for intermediate nodes. 
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1. Introduction 

The aim of quantum cryptography is to establish a shared, secret, and random sequence 
of bits between a sender, called Alice, and a receiver, called Bob pp. This sequence 
constitutes a perfect cryptographic key, a so-called one-time pad, and allows Alice 
and Bob to securely encrypt a message of the same length. The cryptographic key 
is obtained solely via the transmission of photons and classical communication. Each 
bit is encoded in the state of a single photon and read out by Bob upon arrival via a 
quantum measurement. Random switching between different bases makes it impossible 
for an eavesdropper, called Evan, to predict the states used in the protocol. All his 
attempts to intercept photons result in a significant quantum bit error rate (QBER). 
This guarantees a high level of security, since Evan's presence is detected easily when 
Alice and Bob compare a number of test bits. 

Under ideal conditions, the exchange of single photons allows Alice and Bob 
to establish a cryptographic key over an arbitrarily long distance. In practice, 
cryptographic setups consist of imperfect single photon sources, lossy transmission lines, 
and photon detectors with dark count rates. Alice and Bob must hence apply classical 
information processing tools like error correction and privacy amplification [21 E] to 
their data in order to obtain identical secret keys. However, cryptographic protocols are 
only secure as long as it is possible to detect the presence of an eavesdropper. System 
errors could cloud Evan's presence; especially, since he could simply replace parts of the 
equipment with high quality components. This makes it impossible to tolerate large 
system errors and limits the possible distance between Alice and Bob. 

Recently, D. Rosenberg et al. [U [5] reported the creation of a secure cryptographic 
key over a distance of 144.3 km of optical fiber. Their scheme is based on a decoy 
state protocol [6l [Tj, [8] which is immune to photon number splitting attacks and highly 
resistant to Trojan horse attacks [9]. It is expected that improvements in filtering of 
blackbody photons might allow for an extension of the fiber to 250 km. In the mean time, 
H. Takesue et al. [10] and D. Stucki et al. [H] created a secure cryptographic key over 
a distance of 200 km of optical fiber. These experimental setups are believed to be the 
longest terrestrial quantum key distribution fiber-links yet demonstrated. Comparable 
distances have been achieved in free space. For example, T. Schmitt-Manderbach et al. 
[T2] securly distributed a cryptographic key over a 144 km free-space link. 

In this paper, we design a novel quantum key distribution protocol whose minimum 
error rate in the case of eavesdropping increases with the dimension of the photon states 
used by Alice and Bob. In this way, we increase the threshold for tolerable system errors 
without sacrificing the security of the protocol and hence increase the possible distance 
between Alice and Bob. In principle, single photons could be purified with the help of 
quantum repeaters [T3J. Proposals for their implementation (see e.g. Refs. [HI [15] ) 
and other noise reducing links [161 El EEE] have been made but their experimental 
implementation and their practical integration into cryptographic networks remains to 
be seen. 
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The above mentioned long-distance quantum key distribution schemes [U El QUI d2] 
are all based on the BB84 protocol by Bennett and Brassard [19]. In BB84, Alice encodes 
her bits in two-dimensional photon states. These can be obtained using polarisation 
encoding. However, a more natural choice is time-bin encoding, which affords better 
protection of the photons against decoherence [20]. Alice and Bob independently vary 
their bases between two possibilities. A key bit is obtained whenever both use the 
same basis. This means, on average, every second photon contributes a bit to the 
cryptographic key. Using a simple intercept-resend strategy, an eavesdropper introduces 
a QBER of at least 25 % into the communication. 

In the following we assume that Alice and Bob use time-bin or path encoded N- 
dimensional photon states. As in BB84, Alice and Bob randomly vary their bases 
between two mutually unbiased bases [21]. However, contrary to BB84, Alice and Bob 
detect the presence of an eavesdropper by calculating the index transmission error rate 
(ITER). As we shall see below, for N = 2, Evan causes a minimum ITER of 25%. In 
case of four-dimensional photon states, this error rate becomes 37.5 %. When increasing 
N further, the minimum ITER approaches 50 %. The efficiency of the protocol in 
units of transmitted bits per photon is the same as the minimum ITER in case of 
eavesdropping. The states required by the proposed key distribution scheme can be 
realised using a symmetric Bell multiport beam splitter [22J. Before the transmission, 
the path encoding of the output states of the Bell multiport beam splitter should be 
switched to the above mentioned time-bin encoding [20J. 

Several generalisations of quantum cryptographic schemes to higher dimensions 
have already been proposed. Refs. [23j [22J [25], [261 123 (211 [29] are generalisations of the 
original BB84 protocol [19] based on the encoding of information in higher-dimensional 
alphabets. However, recently it has been shown [311 [321 [33] that the security of the 
BB84 protocol is entirely compromised if Alice and Bob share, for example, four- 
dimensional photon states in this way [31]. Refs. [351 EE] propose two alternative 
quantum cryptographic protocols using four- dimensional photon states which, under 
ideal conditions, allow Alice and Bob to communicate directly but whose minimum 
error rates in case of eavesdropping are relatively low. 

Here we show that there are other possible cryptographic schemes in higher 
dimensions. As in Refs. [351 EE] , Alice and Bob use two bases e and / with all states 
of e encoding a "0" and all states of / encoding a "1," even when N is larger than 
two. This means, contrary to Refs. [191 ESI EH EHl EEl EH EHl EH], all vectors of the 
same basis encode the same bit. Moreover, a bit can be transmitted only when Alice 
and Bob use different bases. The quantum key distribution scheme considered in this 
paper is designed such that no conditions have to be posed on the states of e and /, 
thereby giving us a lot of flexibility when maximising the relevant minimum error rate 
introduced by Evan. For simplicity, we consider only intercept-resend eavesdropping 
attacks. This is not the only possible eavesdropping attack, but security against this 
is considered a strong indication for the general security of a quantum cryptographic 
protocol. 
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In the special case of N = 2, the cryptographic scheme proposed in this paper 
is essentially equivalent to the SARG quantum key distribution protocol [30] with the 
parameter x chosen equal to l/\/2. This protocol is tailored to be robust against photon 
number splitting attacks. In the SARG protocol, Alice publicly announces which one of 
the four different sets of states A+,+, A+-, .4.-,+, and A-- she used, while our protocol 
requires her only to announce either u i = 1" or u i = 2." This difference is due to a 
redundancy in the SARG protocol. 

There are five sections in this paper. In Section [2j we introduce the notations used 
throughout this paper. In Section [3j we calculate the ITER and the QBER for the 
quantum key distribution protocol introduced in Section [2] as a function of the states 
used by Alice, Bob, and Evan analytically. Afterwards, we determine their minima 
in the presence of intercept-resend eavesdropping attacks for different iV's numerically. 
Geometrical considerations suggest that Alice and Bob should use two mutually unbiased 
bases. Section @] analyses a concrete protocol based on this idea and shows that mutually 
unbiased bases indeed guarantee a high ITER and a high QBER in case of eavesdropping. 
Finally, we summarise our results in Section [5j 

2. Alternative design 

In quantum cryptography there are conventionally three parties, Alice, Bob, and Evan. 
Alice wants to transmit a sequence of secret bits to Bob. To do so, she prepares 
single photons in certain states and sends them to Bob. Bob measures the state of 
each incoming photon. Afterwards, Alice and Bob exchange information via classical 
communication. At the same time, Evan tries to catch the secret bits without revealing 
his presence. For example, he measures the state of every transmitted photon and listens 
in to the classical communication between Alice and Bob. The cryptographic protocol 
is secure as long as Evan's attempts to obtain information result in an error rate which 
can be detected easily. 

Let us start by introducing sufficient conditions for such a protocol to work: 

(i) Bob should measure the incoming photons in a randomly chosen basis. Otherwise, 
Evan simply uses the same measurement basis and the bit error rate remains zero. 
This means Bob should randomly switch between at least two sets of basis states. 
In the following we assume that this is the case and denote these bases 

e = {\ ei ):i = l,...,N} and f = {\f\) : i = 1, A}. (1) 

Here N is the dimension of the photon states. The only condition imposed on e 
and / is that they form a basis. 

(ii) Similarly, Alice should encode the information that she wants to transmit to Bob 
such that it cannot be deduced easily by Evan. To obtain a non-zero error rate in 
case of eavesdropping, she should either use non-orthogonal states (as in B92 [37] ) 
or randomly switch between at least two sets of basis states (as in BB84 [19J). For 
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Table 1. Bob's interpretation of his measurement outcomes as a function of the index 
announced by Alice. The parameters rjij and Hij can assume the values "0," "1," or 
"x" indicating whether a "0," a "1," or no bit is transmitted. 

simplicity, we assume in the following that Alice prepares each photon randomly in 
one of the basis states of e and /. 

(iii) In order to establish strong correlations between Alice's input state and Bob's 
measurement outcome, Alice needs to reveal some information via classical 
communication. This information should be enough for Alice and Bob to obtain 
a shared secret key bit but not enough for the eavesdropper to deduce it. One 
possibility is that Alice announces which basis, e or /, she used (as in BB84 [T9]). 
Another possibility is that Alice reveals the index i of the respective basis state (as 
in Refs. [351 136])- This does not reveal any information about the key as long as 
the states |e») and \fi) with the same index % encode different bits. In this paper we 
consider this second approach and show that it can guarantee relatively high error 
rates in the presence of an eavesdropper. 

(iv) We now have a closer look at how Bob should interpret his measurement outcomes 
after Alice told him the index i of her basis state. He can do this by using a table 
like Table [TJ If Alice announces that she prepared the photon in a state with index 
i, Bob obtains "77^" when he measures \ej) and he obtains when he measures 
\fj). The parameters 77^ and /jy in the table assume three different values, "0," 
"1," or "x," depending on whether Bob obtains a "0," a "1," or no key bit is 
transmitted. 

Suppose Alice sends a photon prepared in \e±) in order to transmit a "0." This 
implies 

Vll = "0" or "x" (2) 

in order to avoid that Bob obtains a wrong key bit. The state has to encode a 
"1" in this case. Otherwise, Evan knows that a "0" is transmitted, when "i = 1" 
is announced. Consequently, 

fin = "1" or "x" . (3) 

Moreover, if Alice announces u i = 1" and Bob measures \fj) with j ^ 1, then he 
knows for sure that she prepared her photon in |ei). Analogously, if Alice announces 
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Table 2. Bob's interpretation of his measurement outcomes as a function of the index 
announced by Alice for N — 4. All states of e encode a "0," while all states of / encode 
a "1." A key bit is obtained whenever the index of Bob's state is different from Alice's 
index. 

u i = 1" and Bob measures \ej) with j 7^ 1, then he knows that Alice prepared 
Alice and Bob should therefore choose 

rjxj = "I" and /x y = "0" for all j^l. (4) 

There is no need for Bob to ignore a measurement outcome with j ^ 1 since he 
always knows which key bit the photon encodes in this case. 

(v) It is indeed possible (c.f. Eqs. (T5])-(J4])) that Table [1] contains no crosses and that 
every detected photon transmits one bit of the cryptographic key. However, the 
minimum error rate in the case of eavesdropping is already known to be relatively 
low in this case [351 EE]. We therefore assume here that Bob ignores the cases where 
his measured state has the index i announced by Alice and choose 

Vu = Hu = "x" • (5) 

This means a key bit can only be obtained when Bob's measurement basis is 
different from the one used by Alice to prepare the photon. One can easily check 
that Alice and Bob always obtain the same secret key bit under ideal conditions. 

(vi) For symmetry reasons, Alice should have equally many states to encode a "0" as 
she has to encode a "1." Without restrictions we therefore assume in the following 
that all the states of e encode a "0" while all states of / encode a "1." This means, 
Bob obtains a "1" whenever he measures a state \ej) with j different from Alice's 
index i. Analogously, he obtains a "0" when he measures a state \fj) with j ^ i. 

The final protocol is summarised in Table [2] for the case where Alice and Bob 
communicate using four-dimensional photon states. For arbitrary N, the entire scheme 
works as follows: 

(i) Alice generates a random key sequence of classical bits and randomly assigns each 
bit value a random index i — 1, 2, N. 

(ii) Alice then uses this sequence and sends single photons prepared accordingly either 
in |ej) or to Bob. 

(iii) Bob measures the state of every incoming photon, thereby randomly switching the 
measurement basis between e and /. 
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(iv) Alice publicly announces the random sequence of indices i used to establish the 
cryptographic key. 

(v) Bob interprets his measurement outcomes accordingly, using, for example, Table 
El if N = 4. He obtains a key bit whenever his index is different from the index 
announced by Alice. 

(vi) Bob tells Alice which photon measurements have been successful and provide a bit 
of the secret key. 

(vii) Finally, Alice and Bob determine whether an eavesdropper introduced an error into 
their communication. Whenever this error rate is sufficiently small, Alice and Bob 
can assume that no eavesdropping has occurred. 

Notice that no conditions are imposed on e and / in this section other than them 
being bases. This gives us a lot of flexibility when maximising the security of the 
corresponding cryptographic protocol. In fact, the only difference between the above 
protocol and the direct communication scheme introduced in Refs. [351 EE] is that we 
avoid the assumption of (e^/j) being zero. Alice and Bob therefore have to discard their 
measurement outcomes when both their states have the same index. As we shall see 
below, the payoff for the corresponding loss in efficiency is a relatively high error rate 
in the presence of an eavesdropper. 

3. Eavesdropping 

In the quantum key distribution protocol proposed here, the index % of the photon state 
in transmission is the only publicly announced information. This index does not reveal 
any information about the corresponding key bit since it equally likely encodes a "0" as 
it encodes "1." An eavesdropper can therefore only learn about the cryptographic key 
by performing quantum measurements on the transmitted photons. In the following 
we assume that Evan measures the state of every photon using a basis g which is 
optimal for his purpose. Afterwards, he forwards his measurement outcome to Bob. 
This eavesdropping strategy is known as an intercept-res end attack. Although, it is 
not the most general eavesdropping attack, the corresponding error rate is a strong 
indication for the security of a cryptographic protocol. Our aim is to increase the 
minimum error rate introduced by an eavesdropper above the 25 % of the original BB84 
protocol pj5]. As already mentioned above, there are different types of errors which 
Alice and Bob can consider. 

3.1. The index transmission error rate 

In the following, i denotes again the index of the photon state prepared by Alice and j is 
the index of the basis vector measured by Bob. When Alice and Bob use different bases, 
j can assume any value between 1 and N, even in the absence of any eavesdropping. 
However, when Alice and Bob use the same basis, i and j should be the same. To detect 
Evan's presence, Alice and Bob could therefore do the following: Alice should randomly 
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Table 3. Minimum ITER and minimum QBER as a function of N introduced by Evan 
in an intercept-resend eavesdropping attack when Alice and Bob use optimal bases e 
and /. Both error rates are obtained from a numerical simulation which randomly 
generates 100 000 f's and 100 000 c/'s and calculates all the corresponding values for 
Piter and Pqber using Eqs. © and (JTT]). 



select some photons which should not be used to obtain key bits. For these photons, 
she tells Bob exactly which states she prepared. Comparing this information with his 
own measurement outcomes, Bob can then easily calculate the index transmission error 
rate (ITER). 

An index transmission error occurs when a photon prepared in [e») (\fi)) is measured 
at Bob's end as |e 3 -) (\fj)) with i ^ j. Assuming that Alice prepares the 2N basis states 
of e and / with the same frequency and that Bob measures e and / with the same 
frequency, we find that the ITER of the proposed protocol equals 

N N 
i=l k=l jj^i 

for a given set of bases e, /, and g. The states \gk) denote Evan's possible measurement 
outcomes which are forwarded to Bob without alteration. In principle, Evan could 
change the state of the transmitted photon by guessing which state Alice prepared. 
However, this strategy is not expected to reduce the above error rate significantly. A 
non-zero overlap between the basis states of e and / ensures that there is always a 
certain probability to guess incorrectly. 

To simplify Eq. ([6]) we take the normalisation of all the relevant basis vectors into 
account which implies 

N N N N 

Ei^i^i 2 = Ek^>i 2 = Ei^i^i 2 = Ek^>i 2 = l - ( ? ) 

3=1 3=1 k=l k=l 

Substituting these identities into Eq. (JS)), the expression for the ITER simplifies to 

N N 



i-^EEli^i^i'+K^i^i 4 ]- ( 8 ) 



ITER 

=1 k=l 



The same expression is obtained when calculating this error rate by subtracting the 
probability of not making an error under the condition that Alice and Bob use the same 
basis from unity. 




random bases f 

Figure 1. Illustration of the numerical calculation of the minimum ITER introduced 
by Evan for N = 4 and 2 500 random choices of /. The crosses are the minima obtained 
after generating 10 6 <?'s and comparing the corresponding ITER's given by Eq. ([8]) for 
each /. The dotted line shows the theoretical maximum of 37.5% of these minima 
(cf. Eq. (EH). 



While Alice and Bob want the error rate in Eq. ([8]) to be as large as possible, Evan 
wants it to be as small as possible. Both parties, with Alice and Bob on one side and 
Evan on the other side, try to optimise the choice of the bases e, /, and g accordingly. 
Table [3] shows the results of a numerical solution of this double-optimisation problem 
for different dimensions N. To obtain this table, the basis e is kept fixed and a large 
number of bases / is generated randomly. For each / we then generate another large 
set of random bases g and determine the minima of the corresponding error rates using 
Eq. ©. This is illustrated in Fig. Q] for the N = A case. The ITER in Table [3] is the 
maximum of all the obtained minimum error rates. 

For N = 2, we find that the minimum ITER introduced by an eavesdropper equals 
25 % when Alice and Bob use an optimal choice of e and /, as in the original BB84 
protocol [19]. However, when Alice and Bob increase the dimension N of their photon 
states, the minimum ITER increases. One can easily see that 50 % constitutes an 
upper bound for the minimum ITER by considering the case where Evan measures the 
incoming photons either in the e or in the / basis. Using this eavesdropping strategy, 
the states of at least half of the transmitted photons remain unaffected. 

3.2. The quantum bit error rate 

Alternatively, Alice and Bob can detect a potential eavesdropper by calculating the 
usual quantum bit error rate (QBER). To do so, both randomly select a certain number 
of control bits from the obtained key sequence and compare them openly. Notice that a 
key bit is obtained when the index j of the state measured by Bob and the index i of the 
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state prepared by Alice are different. Bob interprets his measurement result correctly 
only when both states belong to a different bases. A quantum bit error hence occurs 
when Bob measures \ej) (\fj)) while Alice prepared |e») (\fi)) with i ^ j. Using Eq. (jBJ), 
the QBER for a given set of bases e, /, and g can be written as 
n -Piter 
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where the index-change (IC) probability Pic, 
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is the probability that the index j of Bob's state is different from the index % of Alice's 
state. Using the identities in Eq. (GO), we find that the QBER in Eq. equals 
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The third column in Table 3 shows the minimum QBER introduced by an eavesdropper, 
when Alice and Bob use optimal bases e and /, for different dimensions N. As in Section 
13. H these probabilities have been obtained by comparing probabilities for a large set of 
randomly generated bases / and g. 

Even for N = 2, the minimum QBER can be as high as 50 %. A more detailed 
analysis of the corresponding protocol shows that Alice and Bob can realise this scenario 
by choosing e and / almost identical, independent of Evan's choice of measurement basis 
g. However, the price they pay for this very high QBER is a steep drop in the efficiency 
of their quantum key distribution. In the extreme case, where |ei) = and \e2) = I/2), 
it becomes impossible to generate secret key bits, since Alice's and Bob's state always 
have the same index i, at least in the absence of any eavesdropping. In the following, 
we assume therefore that Alice and Bob use the ITER in order to detect the presence 
of an eavesdropper. 



4. Optimal choices of e, /, and g 

We now address the question of how Alice and Bob can take advantage of the high 
ITER's shown in Table |3] by having a look at possible realisations of the proposed 
quantum key distribution protocol. First, we consider the N = 2 case which suggests 
an optimal strategy for Alice and Bob in higher dimensions. Moreover, we discuss in 
this section what Evan can do to best cloud his presence. 



4.1. The N = 2 case 

The problems which Alice, Bob, and Evan have to solve in the N = 2 case in order to 
optimise their strategies are exactly the same as in BB84 [19]. Suppose Alice and Bob 
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Figure 2. Basis vectors used by Alice, Bob, and Evan in the N = 2 protocol. To 
maximise the minimum error rate introduced by Evan in case of an intercept-resend 
attack, Alice and Bob should choose <f>\ = W. This yields an error rate of 25 %, 
independent of Evan's choice of 02 . 



choose (cf. Fig. ED 
while \fi) and \f 2 ) are, without restrictions, given by 
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Moreover, we write the states of Evan's optimal measurement b 
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Substituting these states into Eq. (|S]), we find 

Piter = \ [sin 2 (2(0 X - 2 )) + sin 2 (20 2 ) ] . 

In order to maximise the minimum of this probability with respect to 02, Alice and Bob 
should choose 0i = \n. In this case, sin 2 (2(0 X — 2 )) becomes the same as cos 2 (20 2 ). 
This error rate equals 25 % independent of Evan's choice of 02- For the eavesdropper, 
every possible strategy is hence an optimal one. 

In other words, for N = 2, Alice and Bob's optimal choice for e and / are two 
mutually unbiased bases [21]. This means, upon measurement, a photon prepared in 
any of the basis states of e is found with equal probability in any of the basis states of 
/ and vice versa. As shown in Fig. El e and / should be as far away from each other as 
possible. A straightforward generalisation of this result to higher dimensions suggests 
that Alice and Bob should always use two mutually unbiased bases e and /. 
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random bases g 

Figure 3. Numerical calculation of the error rates introduced by Evan for 10 5 
randomly generated four-dimensional g's while the states of e and / are as in Eqs. (fT6|) 
and IT7|) . We see that these rates are always above their theoretical minimum 
(cf. Eq. (I21|) ) of 37.5% (dotted line) which is obtained when Evan measures either 
e or /. 



4.2. TheN = 4 case 



Let us now have a closer look at the case where Alice and Bob communicate with four- 
dimensional photon states. To obtain two mutually unbiased bases, they could choose 
for example 
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To find an optimal intercept-resend strategy for the eavesdropper, we assume that he 
measures states which lie on a line between the closest states of the e and the / basis. 
More concretely, we choose 

cos a \ei) + sin a \fi) 



\9i) 



(l + isim») 1/2 

One can easily check that the {g^'s are normalised and pairwise orthogonal. This applies 
since the indices of the basis states in Eqs. (TT6"j) and (IT7j) have been chosen accordingly. 
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Using Eq. we find that the ITER introduced by Evan now equals 

sin 2 (2a) 



ITER 
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(19) 



Since the second term in the brackets is always positive, one can easily see that 
-Piter > 37.5 %. Indeed, the best strategy for Evan is to choose sin(2a) = 0. This 
means, Evan should measure either e or /. 

Fig. [3] shows the error rate introduced by Evan for the above choice of e and / and 
for a large set of randomly generated g's with N = 4. It confirms that Piter is always 
above 37.5 %, if Alice and Bob use two mutually unbiased bases. This applies even 
when no assumption on the form of the states of g is made, as we do for our analytical 
calculations in Eq. (TTB]) . A comparison of Piter = 37.5% with the result in Table [3] 
for N = A confirms that this error rate corresponds to (or is at least very close to) an 
optimal strategy of Alice, Bob, and Evan. Both results agree within the error limits of 
the underlying numerical calculation. 



4-3. The general case 

Let us now have a look at the optimal choice of e, /, and g for the general case where 
Alice and Bob use iV-dimensional photon states. As suggested at the end of Section 
14.11 we assume that Alice and Bob use two mutually unbiased bases. More concretely, 
we assume that their states are given by 

eij^Sij and = with u N = exp y~j^J > ( 20 ) 

|e») = {en, e i2 , ■-, e iN ) T and \fi) = (fa, f i2 , fiN) T - One can easily check that e and / 
are orthonormal and mutually unbiased. We then generate a large set of random g's and 
calculate the corresponding error rates Piter using Eq. (jSJ). Table H] shows the maxima 
of these rates as a function of N. The given error rates hence correspond to Evan's 
optimal intercept-resend eavesdropping strategy. 

A comparison of the ITER's in Table 0] with the ITER's in Table [3] confirms that 
using two mutually unbiased bases e and / is (at least close to) an optimal strategy for 
Alice and Bob. For N = 2, we find again that the minimum error rate introduced by 
Evan equals 25 %. For N = 3 this rate equals 33 %, and for higher-dimensional photon 
states, the values in the third column of Table H] approach their predicted maximum 
of 50% (cf. Section [3]). The second column has been obtained from a numerical 
optimisation of Evan's strategy. Since it is a relatively hard computational problem to 
find the best eavesdropping measurement basis g numerically, the errors in this column 
are relatively large, especially for large N. 

Let us now have a closer look at the best intercept-resend eavesdropping strategy 
for Evan. The discussion of the N = 4 case in Section 14.21 suggests that Evan should 
measure either e or / in order to minimise the bit transmission error rate. If e and / 
are mutually unbiased, then the probability of detecting a photon in |e^) equals 1/N 
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Dimension N 


(numerics) 


1 1 HitX 

(analytics) 


2 


0.2500 


0.2500 


3 


0.3333 


0.3333 


4 


0.3794 


0.3750 


5 


0.4529 


0.4000 


6 


0.5348 


0.4167 


7 


0.6214 


0.4286 


8 


0.6707 


0.4375 



Table 4. Minimum ITER introduced by an eavesdropper in case of an intercept-resend 
attack when Alice and Bob use the mutually unbiased bases e and / of Eq. ([20)1 . The 
second column is the result of a numerical simulation which generates 5 000 000 g's, 
calculates the respective error rates using Eq. ([5]), and determines their minimum. 
Third column shows the theoretical values given by Eq. (p?Tj) . 



when Alice prepares an /-state. Analogously, the probability of detecting a photon in 
\fi) equals 1/N when Alice prepares an e-state. Substituting this into Eq. (jSJ) yields 

«~ = ^- (») 

For completeness we mention that the corresponding QBER (cf. Eq. (fTTj) ) equals 33% 
independent of N. A comparison with a numerical evaluation of the ITER confirms 
that measuring either e or / and forwarding the respective measurement outcome to 
Bob is indeed an optimal (or at least a close to optimal) strategy for Evan, if Alice and 
Bob test his presence by calculating this error rate. 

Let us conclude this subsection by commenting on the efficiency of the described 
quantum key distribution scheme. As in BB84, Alice and Bob randomly switch between 
two sets of basis states. Here a key bit can only be obtained when both use a different 
basis. Moreover, the index of the state measured by Bob should be different from the 
index of Alice's state. The probability for this to happen and hence the mean number 
of bits per transmitted photon equals 

N- 1 

-'success 2iV ' 



This expression is exactly the same as the ITER in Eq. ( 1211) . 



4-4- Possible implementation 

In order to implement the above protocol, Alice needs a single photon source. As in 
BB84, the photon can come from a parametric down conversion crystal, a very weak 
laser pulse, or an on-demand single-photon source. Using path encoding, the states of 
/ can be prepared easily with the help of a Bell multiport beam splitter. Such a beam 
splitter may consist of a network of beam splitters and phase plates [381 ES] which have 
to be interferometrically stable. It can also be made by splicing N optical fibers [40J. 
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Spliced fibre constructions are commercially available and can include between three 
and thirty input and output ports. 

The main feature of a symmetric N x N Bell multiport beam splitter is that a 
photon entering any of its input ports is redirected with equal likelihood to any of its 
N possible output ports. One way for Alice to prepare the state | e^) in Eq. ( |20l) is to 
bypass the beam splitter and to send a single photon directly to output port i. In this 
case, preparing the state \fi) in Eq. fl20l only requires to send a single photon into input 
port i [22] • Bob can use the same setup as Alice to decode the key bit. To measure /, he 
should send the incoming photon first through a Bell multiport beam splitter and then 
detect it in one of the N output ports. To measure e, he can simply bypass this step. 
During the transmission, the path encoding should be switched to time-bin encoding 
which promises a better protection of the photons against decoherence [20J. 

5. Conclusions 

In this paper we propose a quantum key distribution protocol where Alice and Bob 
use higher-dimensional photon states. The scheme does not encode information in a 
higher- dimensional alphabet [231 EH EEl ES EH EEJ ES] and is not a straightforward 
generalisation of the original BB84 protocol [H]. Instead, Alice and Bob use two bases 
e and / with all e-states encoding a "0" and all /-states encoding a "1." Under ideal 
conditions, a key bit is obtained when Alice and Bob use different bases. In Section 
[21 no conditions are imposed on the states of e and / which gives us the flexibility to 
maximise the error rate introduced by an eavesdropper in case of an intercept-resend 
attack. This is not the only possible eavesdropping strategy but security against this is 
a strong indication for the general security of a cryptographic protocol. 

In Section [3j we generate large sets of random basis states and determine 
the minimum index transmission error rate (ITER) introduced by an eavesdropper 
numerically. For N = 2, this error rate equals the 25 % quantum bit error rate (QBER) 
of the BB84 protocol [19] . However, the minimum ITER rapidly approaches 50 % in 
higher dimensions (cf. Table [3]). A detailed analysis of the N = 2 and the N = 4 case 
suggests that Alice and Bob should use two mutually unbiased basis e and /. The best 
an eavesdropper can do to hide his presence is to measure the transmitted photons either 
in e or /. This hypothesis is consistent with the numerical results in Section H] (cf. Table 
[4j. Finally we point out that the proposed quantum key distribution protocol can be 
implemented for example with the help of a symmetric Bell multiport beam splitter 
[22] and switching from path to time-bin encoding during the transmission. The mean 
number of key bits per transmitted photon turns out to be of exactly the same as the 
minimum error rate introduced by Evan (cf. Eq. ( [221) ). 

In Section [3] we point out that it is in principle possible to obtain a minimum 
QBER close to 50 %, even for N = 2. This requires Alice and Bob to use two bases 
e and / which are almost identical. Unfortunately, this strategy corresponds to a very 
low efficiency of the proposed cryptographic protocol. For e = f, the key transmission 
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rate drops to zero. Analytic expressions for the QBER and the efficiency of the bit 
transmission in the presence of an eavesdropper for a given set of bases can be found in 
Eqs. (HOD and (HI]). 
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